https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T07:47:26.208853+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-09513 bdu:2024-09513 2026-10-03T07:47:26.213534+00:00 bdu:2024-09513 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0948 certfr-2024-avi-0948 — De multiples vulnérabilités ont été découvertes dans les produits Symfony. Certaines d'entre elles permettent à un atta… 2026-10-03T07:47:26.213578+00:00 certfr-2024-avi-0948 https://cve.radiocsirt.org/vuln/euvd-2026-199902 EUVD-2026-199902 2026-10-03T07:47:26.213633+00:00 EUVD-2026-199902 https://cve.radiocsirt.org/vuln/fkie_cve-2024-50340 fkie_cve-2024-50340 2026-10-03T07:47:26.213645+00:00

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-x8vp-gf4q-mw5j GHSA-x8vp-gf4q-mw5j — Symfony allows changing the environment through a query 2026-10-03T07:47:26.213678+00:00

Affected: Packagist: symfony/runtime, Packagist: symfony/symfony

### Description

When the `register_argc_argv` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request.

### Resolution

The `SymfonyRuntime` now ignores the `argv` values for non-cli SAPIs PHP runtimes

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa) for branch 5.4.

### Credits

We would like to thank Vladimir Dusheyko for reporting the issue and Wouter de Jong for providing the fix.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-50340 UBUNTU-CVE-2024-50340 2026-10-03T07:47:26.213712+00:00

Affected: Ubuntu:Pro:22.04:LTS: symfony, Ubuntu:Pro:24.04:LTS: symfony, Ubuntu:25.10: symfony, Ubuntu:26.04:LTS: symfony

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability.